Lint packages: fetch and store GitHub rule packages by commit SHA #842

Part of #616. Decisions: see the owner comments there.

Desired behavior

Wright can fetch a lint rule package from a GitHub repository at an exact commit and keep it in a Wright-owned, immutable local store, without depending on git.

Scope

• Resolve a tag, branch, or URL to a full commit SHA with the commits API, using ETag conditional requests.
• Download the tarball for a full SHA from codeload.github.com with the workspace's reqwest, unpack it into a cache directory <owner>/<repo>/<full-sha>/, and read only rules/*.yaml|yml. Repository code is never executed.
• Optional GITHUB_TOKEN: raises API limits and reads private repositories; sent to the API host only.
• Validate a package against the existing SPEC-309 loader: refuse empty, malformed, incompatible, or duplicate-ID packages with an explicit diagnostic.
• Distinguish unchanged, updated, unavailable, and error states for a remote check.

Non-goals

Project configuration, user-facing commands, Topic discovery, and the first-party package (separate sub-issues).

Acceptance criteria

• A package is fetched by full SHA into the store; a second fetch of the same SHA makes no download.
• A tag resolves to the SHA it points at; only the SHA is stored.
• A package with an invalid, incompatible, empty, or duplicate-ID rule is refused with a diagnostic naming the file, and no findings are produced from it.
• A network failure, a missing repository or SHA, and a rate limit each yield a distinct actionable error and no partial store entry.
• Tests run offline against recorded responses; no test needs real network access.

Dependencies

The accepted SPEC-309 loader (confirm against current code before starting).